Mantax Otax pairs Android surveillance with wider file encryption on Android 9 and earlier

Zimperium zLabs has documented evidence that Mantax Otax reached real Android devices, where the sideloaded malware can steal data, monitor activity and pressure victims through on-device extortion. Its 9 September analysis describes two malware versions and an infection chain that requires a user to install a malicious APK and grant powerful permissions. No Android vulnerability, privilege-escalation flaw or remote-code-execution bug was identified.

Zimperium said some samples were standalone APKs hosted on a third-party file-sharing service. It also reported victim-derived files, extortion conversations and infected-device records in exposed operator infrastructure, and published an image it described as an interface listing infected devices. Those findings support active use rather than a laboratory-only proof of concept, but the company did not publish a reliable victim count.

Installation is user-assisted. Once the APK is installed, Mantax Otax requests device-administrator privileges, Android Accessibility access and sensitive permissions for storage, screen capture, overlays and other device functions. This is abuse of access granted to the application, not a zero-click attack or exploitation of a CVE. Zimperium suggested shared links, messaging, phishing and social engineering as possible ways to persuade users to sideload it, but the directly documented distribution evidence was limited to third-party file hosting.

Android version changes the ransomware impact

The file-encryption component is most destructive on Android 9 and earlier. On those releases, Zimperium observed recursive encryption of shared external storage with a victim-specific AES key. The malware deleted the original accessible files and created encrypted replacements with an .enc suffix. It could also alter images with an extortion notice and display an interactive on-screen chat used for ransom negotiations.

Android 10 and later change that outcome through Scoped Storage. Zimperium found the ransomware component was largely confined to the application’s own external-files directory, substantially reducing access to user files. The protection limits the encryption blast radius, but it does not establish that newer devices are immune to Mantax Otax’s surveillance, theft or remote-control features. Zimperium did not publish a complete feature-by-version compatibility matrix.

The reported collection functions cover SMS messages and one-time passwords, contacts, call logs, notifications, browser history, files, gallery content, location, device details and linked account information. Zimperium also documented screenshots, video recording and near-real-time display capture, as well as a separate function that can take photographs through the device cameras. Together, these capabilities allow operators to monitor activity and exfiltrate personal data from an infected handset.

Mantax Otax can also use Accessibility-driven interaction to collect WhatsApp and Telegram content shown on the compromised device. That does not indicate a cryptographic break of either service. The malware captures information at the endpoint, where it is already displayed to the user.

A second version expands remote disruption

Both analysed versions dynamically obtain command-and-control addressing through a GitHub-hosted reference and register device and environment information with a backend. Zimperium found that the first version used Firebase for operator communications, while the second introduced WebSocket communications and additional disruption controls. The disclosed use of those services does not imply a vulnerability in either platform.

The second version can block devices and applications, interfere with touch input, place repeated visual overlays on the screen, show full-screen media and produce remotely generated text-to-speech output. Combined with screen locking and the ransom chat, these functions can deprive a user of normal access to the handset while enabling direct harassment and pressure from the operator.

Zimperium linked the operation to unidentified Indonesian threat actors with low confidence and assessed it as focused on Indonesian targets. The company cited language indicators and victim files, but no named group or independently corroborated attribution was provided. Evidence of an Indonesian target set does not prove the nationality or location of the operators. The disclosed evidence supports data exfiltration from infected devices, but no ransom payment, financial loss, resulting fraud or public release of stolen information has been confirmed.

Defence depends on installation and permission controls

The disclosure provides no CVE, patch or fixed Android version. The infection route instead depends on sideloading and user-granted privileges. Users should install applications only from approved official or enterprise-managed sources and reject unexpected requests for device-administrator access, Accessibility access, screen capture or broad data permissions. Managed fleets can audit and restrict those privileges and monitor for sideloaded applications or unexpected Accessibility-service activation.

Google’s general Android documentation says Play Protect scans applications from sources outside Google Play and may warn about, disable or remove harmful software. Google’s enterprise guidance says administrators can enforce Play Protect through mobile management. Google has not supplied Mantax Otax-specific confirmation that every known sample is detected, so Play Protect should remain one layer of defence rather than be treated as complete remediation.

Replacing or upgrading Android 9 and earlier devices should be prioritised because Scoped Storage materially reduces broad shared-storage encryption on Android 10 and later. That upgrade does not remove the need to govern permissions or sideloading, particularly in unmanaged bring your own device environments, because the available research does not establish that other malicious functions are blocked on current releases.

No Australian victims or Australia-specific targeting were reported by the evidence cutoff. No victim-sector profile or broader geographic reach was established either. For Australian consumers and organisations, the relevance is preventive: sideloading, unmanaged bring your own device use and continued reliance on older Android releases could create the same technical exposure if a sample is installed and receives the requested permissions. The victim count, campaign start date, operator identity and current status of the backend infrastructure remain unknown, leaving the operation’s scale and present reach unresolved.

Encrypted messaging can remain cryptographically intact while malicious software reads content already displayed at the endpoint, making trust boundaries essential to understanding the risk. Explore The Hack Academy’s online cybersecurity training programme for self-paced learning and practical exercises alongside theory; its listed subjects include cryptography and cybersecurity fundamentals.